Initia Reports Second Exploit in 3 Weeks, $3.27M Stolen

Initia, a layer-1 blockchain, confirmed it has suffered its second security exploit in under three weeks, with an attacker stealing roughly $3.27 million worth of crypto assets after compromising the network’s cloud infrastructure.

The latest incident underscores a persistent risk pattern for web3 systems: once attackers gain control of the cloud or developer tooling behind a blockchain, they can potentially access credentials, validate fraudulent actions, and move funds—sometimes even before on-chain defenses can fully respond.

Key takeaways

• Initia says the attacker used a command injection attack tied to a compromised Google Cloud Platform key to gain unauthorized access.
• The breach exposed environment variables, which Initia says enabled access to its GitHub and cloud accounts and the retrieval of further credentials.
• Initia reports that fraudulent Inter-Blockchain Communication (IBC) withdrawals were validated from five rollups, emptying assets from escrow accounts.
• About $2.16 million of the stolen funds remain frozen because Initia halted the network.
• No INIT tokens were withdrawn, according to Initia.

Second exploit targets cloud access and credentials

Initia said in an update posted Wednesday that the attacker obtained unauthorized access on Monday via a command injection attack that involved a compromised Google Cloud Platform key. In practical terms, the company described the compromise as extending beyond a single service: it said the attacker was able to view environment variables, which then provided a path to additional systems.

According to Initia, the exposed environment variables allowed the attacker to access its GitHub and cloud accounts, and to obtain additional credentials. That expanded access helped the attacker move from intrusion into execution—reaching operational components connected to how the network processes rollup activity.

Fraudulent IBC withdrawals through rollup infrastructure

Initia stated that the attacker accessed Anvil, a platform used to host rollups, and then validated fraudulent IBC withdrawals from five rollups. By doing so, the attacker triggered withdrawals of assets held in Initia’s escrow accounts.

In its account of the theft, Initia said the stolen assets included multiple stablecoin holdings and wrapped versions recorded across different denominations. It reported that approximately $2.16 million remains frozen on its halted network.

Initia further said the attacker sold assets on its decentralized exchange and withdrew the following amounts: 13,400 TIA, 8,000 USDC, 597,000 Noble USDC. The company also noted that no INIT tokens were taken.

Network halt and recovery efforts begin

Initia said it halted its layer-1 network on Tuesday. The halt is intended to prevent further processing of compromised workflows while recovery actions are carried out, particularly when fraudulent message validation or withdrawal execution may otherwise continue.

Initia said it plans to restore backing of affected assets and that recovery efforts are ongoing with law enforcement and security partners. For investors and users, the key near-term question is whether the frozen portion can be secured long-term and how quickly the remaining system components—such as rollup-hosting infrastructure and credential management—can be hardened against the same attack path.

Earlier Oct. 23 exploit shows a recurring breach theme

This incident follows an earlier exploit disclosed by Cointelegraph on Oct. 23. In that case, Initia halted the blockchain after an attacker drained about $2.7 million by exploiting a vulnerability in Initia’s MoveVM script cache. Initia said that the vulnerability enabled malicious code to bypass security checks and create unbacked token balances, which were then bridged out of the network.

While the two incidents differ in technical mechanism—one tied to VM/script-cache behavior and the other tied to cloud credential compromise and command injection—they share a common operational vulnerability: an attacker found a way to move from system access to fund movement before complete containment.

Another notable asymmetry is how the two events were contained. In the latest theft, Initia says the network halt left about $2.16 million frozen, whereas the earlier exploit resulted in a larger total drain before mitigation. That difference suggests that timing and detection—plus the ability to rapidly stop further processing—can materially change outcomes even when the underlying security posture is still under strain.

For readers following Initia, the most important updates to watch are the details of what credentials were exposed, what remediation steps have been applied to cloud and rollup infrastructure, and whether the company can fully restore backing for all affected assets without new complications. With two major incidents in under three weeks, the next phase will likely focus as much on preventing credential-based access from recurring as it does on returning funds.